Skip to content

YAML lint

Lint a YAML document (or paste it in) for syntax errors with line and column, duplicate keys, non-safe tags (python/ruby/…), and the "alias bomb" shape.

YAMLlintvalidation

Upload

Files (0–1)
One YAML document, up to 2 MB, or paste it below. Multi-document streams (separated by '---') are accepted. Nothing is transformed; you get a lint report.
Paste a YAML document instead of uploading a file. The same security checks (never constructs objects from the input) and the same report apply.
Questions people ask
Is this the same as JSON lint?
The same idea with the YAML differences. YAML supports multi-document streams (separated by `---`), the anchor/alias mechanism, and a much richer tag system, which is why the non-safe-tag check is a load-bearing verdict here and not in the JSON tool. Both tools report positions in line and column.
What do "non-safe tags" mean?
YAML allows tags like `!!python/apply os.system` that, to a parser that constructs objects, can run arbitrary code. This tool never constructs objects (it only composes the document into a node tree), so a hostile document cannot execute anything here, and the report names each offending tag, with its line and column, as an error finding, because a *downstream* safe-load consumer is going to reject the same document. The verdict is aligned with what your code will see.
Does a syntax error make the job fail?
No. A document that cannot be read is the answer, not the accident. The job completes and the report carries the syntax error with its line and column. The job only fails on processor faults: no input, an unreadable input, or a document past the 2 MB cap.
What is an "alias bomb"?
A YAML document that anchors one large structure and references it thousands of times via `*` aliases. It is a classic denial-of-service shape: safe-load parses it in linear time, but a naive renderer or text-expander can be driven quadratic or worse by it. This tool flags, as a warning, any node referenced more than 2047 times. The document still composes, but you should want to look at what it is doing before passing it to another tool.
Do you keep my file?
No. The document is read in an isolated job, the report is generated, and the upload is removed as soon as that finishes. Your report stays available for about 10 minutes, then it is automatically deleted too.